Security july 2026

.circleci/config.yml

@@ -68,7 +68,7 @@ workflows:
           branches:
             only:
               - develop
-              - pm-2539
+              - security_july_2026
 
     # Production builds are exectuted only on tagged commits to the
     # master branch.
@@ -77,4 +77,4 @@ workflows:
         filters:
           branches:
             only:
-              - master
+              - master

.dockerignore

@@ -0,0 +1,5 @@
+.git
+.github
+coverage
+dist
+node_modules

.nvmrc

@@ -1 +1 @@
-v22.13.1
+v26.5.0

Dockerfile

@@ -1,20 +1,41 @@
-# syntax=docker/dockerfile:1
+# syntax=docker/dockerfile:1.7
 
-FROM node:22.13.1-alpine
+ARG NODE_VERSION=26.5.0
+ARG PNPM_VERSION=11.15.1
 
-RUN apk add --no-cache bash
-RUN apk update
+FROM node:${NODE_VERSION}-alpine AS build
+
+RUN apk upgrade --no-cache \
+    && apk add --no-cache bash
+
+WORKDIR /app
+COPY . .
+RUN npm install --global pnpm@${PNPM_VERSION}
+RUN pnpm install --frozen-lockfile
+RUN pnpm run lint
+RUN pnpm run build
+RUN pnpm prune --prod
+RUN node node_modules/prisma/build/index.js generate
+
+FROM node:${NODE_VERSION}-alpine AS runtime
+
+RUN apk upgrade --no-cache \
+    && apk add --no-cache bash \
+    && rm -rf /usr/local/lib/node_modules/npm \
+    && rm -f /usr/local/bin/npm /usr/local/bin/npx
 
 ARG RESET_DB_ARG=false
 ENV RESET_DB=$RESET_DB_ARG
 ARG SEED_DATA_ARG=""
 ENV SEED_DATA=$SEED_DATA_ARG
 ENV PRISMA_CLI_BINARY_TARGETS=linux-musl-openssl-3.0.x
+ENV NODE_ENV=production
 
 WORKDIR /app
-COPY . .
-RUN npm install pnpm -g
-RUN pnpm install
-RUN pnpm run build
+COPY --from=build /app/dist ./dist
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/prisma ./prisma
+COPY --from=build /app/package.json ./package.json
+COPY --from=build /app/appStartUp.sh ./appStartUp.sh
 RUN chmod +x appStartUp.sh
-CMD ./appStartUp.sh
+CMD ["./appStartUp.sh"]

README.md

@@ -2,6 +2,8 @@
 
 Group API built on modern frameworks for managing all group-related Topcoder needs.
 
+Use Node.js 26.5.0 and pnpm 11.15.1. Run `nvm use` in this project before running pnpm commands.
+
 ## Project setup
 
 ```bash
@@ -30,12 +32,12 @@ docker run -p 5432:5432  -e POSTGRES_PASSWORD=mysecretpassword postgres:14
 export DATABASE_URL="postgresql://postgres:mysecretpassword@localhost:5432/group-api?schema=groups"
 
 # run migration
-npx prisma migrate dev
+pnpm exec prisma migrate dev
 
 # seed data
-npx prisma db seed
+pnpm exec prisma db seed
 or
-npx prisma migrate reset
+pnpm exec prisma migrate reset
 
 # if you modify prisma schema, run migration again
 # and it'll ask
@@ -54,8 +56,8 @@ npx prisma migrate reset
 - update the postgres database url in .env file —
   `DATABASE_URL="postgresql://postgres:mysecretpassword@localhost:5432/group-api?schema=groups"`
 - install dependencies `pnpm install`
-- run the prisma migration `npx prisma migrate dev`
-- run the prisma seed `npx prisma db seed`
+- run the prisma migration `pnpm exec prisma migrate dev`
+- run the prisma seed `pnpm exec prisma db seed`
 - run the project `pnpm run start`
 
 

appStartUp.sh

@@ -6,11 +6,11 @@ export DATABASE_URL=$(echo -e ${DATABASE_URL})
 echo "Database - running migrations."
 if $RESET_DB; then
     echo "Resetting DB"
-    npx prisma migrate reset --force
+    node node_modules/prisma/build/index.js migrate reset --force
 else
     echo "Running migrations"
-    npx prisma migrate deploy
+    node node_modules/prisma/build/index.js migrate deploy
 fi
 
 # Start the app
-pnpm start:prod
+exec node dist/src/main

package.json

@@ -4,6 +4,7 @@
   "description": "",
   "author": "",
   "private": true,
+  "packageManager": "pnpm@11.15.1",
   "license": "UNLICENSED",
   "scripts": {
     "build": "nest build",
@@ -12,36 +13,36 @@
     "start:dev": "nest start --watch",
     "start:debug": "nest start --debug --watch",
     "start:prod": "node dist/src/main",
-    "lint": "eslint \"{src,apps,libs,test,prisma}/**/*.ts\" --fix",
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\" \"prisma/**/*.ts\" --fix --no-error-on-unmatched-pattern",
     "test": "jest",
     "test:watch": "jest --watch",
     "test:cov": "jest --coverage",
     "test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
     "test:e2e": "jest --config ./test/jest-e2e.json",
-    "postinstall": "npx prisma generate"
+    "postinstall": "pnpm exec prisma generate"
   },
   "dependencies": {
     "@nestjs/axios": "^4.0.0",
-    "@nestjs/common": "^11.0.1",
-    "@nestjs/core": "^11.0.1",
+    "@nestjs/common": "^11.1.28",
+    "@nestjs/core": "^11.1.28",
     "@nestjs/mapped-types": "^2.1.0",
-    "@nestjs/platform-express": "^11.0.1",
-    "@nestjs/swagger": "^11.0.3",
-    "@prisma/client": "^6.3.1",
-    "@types/jsonwebtoken": "^9.0.9",
-    "axios": "^1.9.0",
+    "@nestjs/platform-express": "^11.1.28",
+    "@nestjs/swagger": "^11.4.6",
+    "@prisma/client": "6.19.3",
+    "axios": "^1.18.1",
     "class-transformer": "^0.5.1",
-    "class-validator": "^0.14.1",
+    "class-validator": "^0.14.4",
     "cors": "^2.8.5",
-    "jsonwebtoken": "^9.0.2",
+    "jsonwebtoken": "^9.0.3",
     "jwks-rsa": "^3.2.0",
-    "lodash": "^4.17.21",
-    "qs": "^6.14.0",
+    "lodash": "^4.18.1",
+    "prisma": "6.19.3",
+    "qs": "^6.15.3",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1",
     "tc-core-library-js": "topcoder-platform/tc-core-library-js.git#master",
     "tc-bus-api-wrapper": "github:topcoder-platform/tc-bus-api-wrapper.git",
-    "uuid": "^11.1.0"
+    "uuid": "^14.0.1"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.2.0",
@@ -53,6 +54,7 @@
     "@swc/core": "^1.10.7",
     "@types/express": "^5.0.0",
     "@types/jest": "^29.5.14",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/lodash": "^4.17.20",
     "@types/node": "^22.10.7",
     "@types/supertest": "^6.0.2",
@@ -63,7 +65,6 @@
     "globals": "^15.14.0",
     "jest": "^29.7.0",
     "prettier": "^3.4.2",
-    "prisma": "^6.3.1",
     "source-map-support": "^0.5.21",
     "supertest": "^7.0.0",
     "ts-jest": "^29.2.5",
@@ -75,7 +76,7 @@
     "winston": "^3.17.0"
   },
   "prisma": {
-    "seed": "ts-node prisma/seed.ts"
+    "seed": "node dist/prisma/seed.js"
   },
   "jest": {
     "moduleFileExtensions": [